OpenEMR vulnerabilities

CVEs per yearBy the year they were published

1. 202226
2. 202311
3. 20241
4. 20259
5. 2026145

Newest CVEs

• CVE-2026-124490

  OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument

  openemr · openemr

  Critical9.4
• CVE-2026-124489

  OpenEMR before 8.3.0 Broken Access Control via portal_payment.php

  openemr · openemr

  High7.1
• CVE-2026-124488

  OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters

  openemr · openemr

  High8.6
• CVE-2026-124487

  OpenEMR before 8.4.0 Improper Authorization in FHIR DocumentReference $docref

  openemr · openemr

  High7.1
• CVE-2026-124486

  OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller

  openemr · openemr

  High8.7
• CVE-2026-124485

  OpenEMR before 8.3.0 Cross-Patient Document Disclosure via Onsite Documents API

  openemr · openemr

  High7.1
• CVE-2026-124484

  OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs

  openemr · openemr

  High8.7
• CVE-2026-124483

  OpenEMR before 8.4.0 Improper Authorization via Prescription REST API

  openemr · openemr

  High8.7
• CVE-2026-124482

  OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launch

  openemr · openemr

  High7.1
• CVE-2026-124481

  OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments

  openemr · openemr

  High7.1